feat: set proper description and tags on collector-created security platforms (#539) - #540
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enhances collector-created security platform assets by ensuring they are created with meaningful default metadata (description + tags) and by forwarding those values to the daemon configuration, so Security Platform cards in the UI are no longer empty for collectors that auto-register a platform.
Changes:
- Added default
platform_descriptionandplatform_tagsto collectors that create acollector_platform. - Updated each affected
to_daemon_config()to forwardcollector_platform_descriptionandcollector_platform_tagsto the daemon. - Documented the new optional configuration keys in the template collector settings model.
Reviewed changes
Copilot reviewed 30 out of 30 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| xtm-one/xtm_one/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| xtm-one/xtm_one/configuration/collector_config_override.py | Adds default platform description/tags for XTM One’s auto-created platform. |
| template/src/models/settings/config_loader.py | Forwards platform description/tags into the daemon config hints (template pattern). |
| template/src/models/settings/collector_configs.py | Documents optional COLLECTOR_PLATFORM_DESCRIPTION / COLLECTOR_PLATFORM_TAGS settings (defaults to None). |
| tanium-threat-response/tanium_threat_response/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| tanium-threat-response/tanium_threat_response/configuration/collector_config_override.py | Adds default platform description/tags for Tanium Threat Response’s auto-created platform. |
| splunk-es/src/models/configs/config_loader.py | Adds defaults for description/tags and forwards them into the daemon config hints. |
| sentinelone/src/models/configs/config_loader.py | Adds defaults for description/tags and forwards them into the daemon config hints. |
| qradar/src/models/configs/config_loader.py | Adds defaults for description/tags and forwards them into the daemon config hints. |
| prompt-security/prompt_security/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| prompt-security/prompt_security/configuration/collector_config_override.py | Adds default platform description/tags for Prompt Security’s auto-created platform. |
| prisma-airs/prisma_airs/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| prisma-airs/prisma_airs/configuration/collector_config_override.py | Adds default platform description/tags for Prisma AIRS’ auto-created platform. |
| palo-alto-cortex-xsoar/src/models/settings/config_loader.py | Adds defaults for description/tags and forwards them into the daemon config hints. |
| palo-alto-cortex-xdr/src/models/settings/config_loader.py | Adds defaults for description/tags and forwards them into the daemon config hints. |
| netwitness/src/models/configs/config_loader.py | Adds defaults for description/tags and forwards them into the daemon config hints. |
| microsoft-sentinel/microsoft_sentinel/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| microsoft-sentinel/microsoft_sentinel/configuration/collector_config_override.py | Adds default platform description/tags for Microsoft Sentinel’s auto-created platform. |
| microsoft-defender/microsoft_defender/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| microsoft-defender/microsoft_defender/configuration/collector_config_override.py | Adds default platform description/tags for Microsoft Defender for Endpoint’s auto-created platform. |
| logrhythm/src/models/configs/config_loader.py | Adds defaults for description/tags and forwards them into the daemon config hints. |
| lakera-guard/lakera_guard/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| lakera-guard/lakera_guard/configuration/collector_config_override.py | Adds default platform description/tags for Lakera Guard’s auto-created platform. |
| hiddenlayer/hiddenlayer/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| hiddenlayer/hiddenlayer/configuration/collector_config_override.py | Adds default platform description/tags for HiddenLayer AIDR’s auto-created platform. |
| elastic/src/models/configs/config_loader.py | Adds defaults for description/tags and forwards them into the daemon config hints. |
| crowdstrike/crowdstrike/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| crowdstrike/crowdstrike/configuration/collector_config_override.py | Adds default platform description/tags for CrowdStrike Falcon’s auto-created platform. |
| cisco-ai-defense/cisco_ai_defense/configuration/config_loader.py | Forwards platform description/tags into the daemon config hints. |
| cisco-ai-defense/cisco_ai_defense/configuration/collector_config_override.py | Adds default platform description/tags for Cisco AI Defense’s auto-created platform. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
collector_platform: each now provides a defaultplatform_description(short description of the security product and how the collector uses it to validate expectations) and defaultplatform_tags(e.g. ["edr", "microsoft"], ["siem", "splunk"], ["llm-firewall", "cisco"]) for the security platform it auto-creates, so the read-only cards are no longer empty in the Security platforms screen.to_daemon_config()forwards the newcollector_platform_description/collector_platform_tagskeys to the daemon; both fields are operator-configurable (env/config override) and optional.Covered: cisco-ai-defense, crowdstrike, elastic, hiddenlayer, lakera-guard, logrhythm, microsoft-defender, microsoft-sentinel, netwitness, palo-alto-cortex-xdr, palo-alto-cortex-xsoar, prisma-airs, prompt-security, qradar, sentinelone, splunk-es, tanium-threat-response, template, xtm-one. Collectors that only reference expected security platform types on payloads (openaev, atomic-red-team) do not create platform assets and are unaffected.
Requires the companion pyoaev change (OpenAEV-Platform/client-python#320) for the daemon to consume the new keys; until pyoaev is bumped the extra config hints are simply ignored, so this is safe to merge independently.
Closes #539
Test plan
ConfigLoader().to_daemon_config()exposescollector_platform_description/collector_platform_tagsto the daemon